01 02

iptables bloqueia tudo

1. iptables bloqueia tudo

beyraq
(usa Arch Linux)

Enviado em 14/02/2012 - 12:50h

Olá, onde está o erro?

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1492 metric 1
inet 10.252.21.74 netmask 255.255.255.192 broadcast 10.252.21.127
inet6 fe80::2000:aff:fefc:154a prefixlen 64 scopeid 0x20<link>
ether 22:00:0a:fc:15:4a txqueuelen 1000 (Ethernet)
RX packets 844 bytes 68702 (67.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 520 bytes 87467 (85.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 24

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 16436 metric 1
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

#!/bin/bash

IFACE_WEB="eth0"
REDE_INTERNA="10.0.0.0/24"
PORTAS_TCP="20,21,53,80,443"
PORTAS_UDP="53"

iptables -F
iptables -t nat -F

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT

iptables -A INPUT -s $REDE_INTERNA -p icmp --icmp-type 8 -j ACCEPT

iptables -A OUTPUT -p tcp -m multiport --dports $PORTAS_TCP -j ACCEPT

iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -i ppp+ -j ACCEPT
iptables -A OUTPUT -o ppp+ -j ACCEPT

iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p 47 -j ACCEPT
iptables -A OUTPUT -p 47 -j ACCEPT

iptables -F FORWARD
iptables -A FORWARD -j ACCEPT

iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE
iptables -A POSTROUTING -t nat -o ppp+ -j MASQUERADE

0 0

Quote

2. Forward

andrecanhadas
(usa Debian)

Enviado em 14/02/2012 - 13:01h

Faltou o FORWARD para as portas TCP:

iptables -A FORWARD -p tcp -m multiport --dports $PORTAS_TCP -j ACCEPT

0 0

Quote

3. Re: iptables bloqueia tudo

beyraq
(usa Arch Linux)

Enviado em 14/02/2012 - 13:18h

Obrigado, usei a dica mas não funcionou.

Nem ping faz depois que ativa o firewall.

0 0

Quote

4. Internet

andrecanhadas
(usa Debian)

Enviado em 14/02/2012 - 14:25h

Vc tem dois links de internet?
Não entendi pq o masquerade das duas placas:
iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE
iptables -A POSTROUTING -t nat -o ppp+ -j MASQUERADE

Adiciona isso no firewall para Limpar todas as tabelas do firewall:
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -t mangle -F
/sbin/iptables -t filter -F
/sbin/iptables -X
/sbin/iptables -Z
echo 1 > /proc/sys/net/ipv4/ip_forward

## fim ##

(Faltou isso para funcionar) Ativar ip_forward
echo 1 > /proc/sys/net/ipv4/ip_forward

0 0

Quote

5. Re: iptables bloqueia tudo

beyraq
(usa Arch Linux)

Enviado em 14/02/2012 - 17:47h

Usei suas últimas dicas e não foi, acho que é o pode ser aqui REDE_INTERNA="10.0.0.0/24"

É que uso PPTP https://wiki.archlinux.org/index.php/PPTP_Server então, quando ativo o firewall "fica sem internet" é um VPS, mas a VPN funciona, só voltar ter internet se fizer # reboot e o iptables -F trava, tenho que reinicia o VPS pelo navegador.

0 0

Quote

6. Re: iptables bloqueia tudo

phrich
(usa Slackware)

Enviado em 16/02/2012 - 22:04h

Tente colocar suas regras de nat antes das regras de INPUT, OUTPUT E FORWARD, depois conte se deu certo...

0 0

Quote

7. Saida

andrecanhadas
(usa Debian)

Enviado em 16/02/2012 - 22:13h

beyraq escreveu:

Usei suas últimas dicas e não foi, acho que é o pode ser aqui REDE_INTERNA="10.0.0.0/24"

É que uso PPTP https://wiki.archlinux.org/index.php/PPTP_Server então, quando ativo o firewall "fica sem internet" é um VPS, mas a VPN funciona, só voltar ter internet se fizer # reboot e o iptables -F trava, tenho que reinicia o VPS pelo navegador.

Posta a saida do comando:
ifconfig -a

e seu firewall depois das modificações

0 0

Quote

8. Re: iptables bloqueia tudo

beyraq
(usa Arch Linux)

Enviado em 16/02/2012 - 23:40h

Obrigado, mas ainda não funciona.

PS: Quando ativo o PPTP no iOS, aparece o ppp0 no ifconfig, ele funciona.

[root@arch ~]# ifconfig -a
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1492 metric 1
inet 10.252.21.74 netmask 255.255.255.192 broadcast 10.252.21.127
ether 22:00:0a:fc:15:4a txqueuelen 1000 (Ethernet)
RX packets 386 bytes 34192 (33.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 280 bytes 39637 (38.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
device interrupt 24

gre0: flags=128<NOARP> mtu 1476 metric 1
unspec 00-00-00-00-FF-C0-00-00-00-00-00-00-00-00-00-00 txqueuelen 0 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING> mtu 16436 metric 1
inet 127.0.0.1 netmask 255.0.0.0
loop txqueuelen 0 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1488 metric 1
inet 10.252.21.74 netmask 255.255.255.255 destination 10.252.21.75
ppp txqueuelen 3 (Point-to-Point Protocol)
RX packets 47 bytes 4069 (3.9 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 38 bytes 3172 (3.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

#!/bin/bash

IFACE_WEB="eth0"
REDE_INTERNA="10.0.0.0/24"
PORTAS_TCP="20,21,53,80,443"
PORTAS_UDP="53"
PORTAS_REDE_INTERNA="21,22,25,53,53,110,443"

iptables -F
iptables -t nat -F
iptables -X
iptables -t filter -F
iptables -Z
iptables -t mangle -F

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE
iptables -A POSTROUTING -t nat -o ppp+ -j MASQUERADE

iptables -t nat -A POSTROUTING -s $REDE_INTERNA -o $IFACE_WEB -j MASQUERADE

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT

iptables -A INPUT -s $REDE_INTERNA -p icmp --icmp-type 8 -j ACCEPT

iptables -A FORWARD -p tcp -m multiport --dports $PORTAS_REDE_INTERNA -j ACCEPT

iptables -A OUTPUT -p tcp -m multiport --dports $PORTAS_TCP -j ACCEPT

iptables -A FORWARD -p tcp -m multiport --dports $PORTAS_TCP -j ACCEPT

iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A INPUT -i ppp+ -j ACCEPT
iptables -A OUTPUT -o ppp+ -j ACCEPT

iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p 47 -j ACCEPT
iptables -A OUTPUT -p 47 -j ACCEPT

iptables -F FORWARD
iptables -A FORWARD -j ACCEPT

0 0

Quote

9. Tenta assim

andrecanhadas
(usa Debian)

Enviado em 17/02/2012 - 00:17h

Tenta assim sem mudar nada:

#!/bin/bash

IFACE_WEB="eth0"
REDE_INTERNA="10.0.0.0/24"
PORTAS_TCP="20,21,53,80,443"
PORTAS_UDP="53"
PORTAS_REDE_INTERNA="21,22,25,53,53,110,443"

iptables -F
iptables -t nat -F
iptables -X
iptables -t filter -F
iptables -Z
iptables -t mangle -F

modprobe ip_nat

iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP

# OUTPUT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports $PORTAS_TCP -j ACCEPT
iptables -A OUTPUT -p udp -m multiport --dports $PORTAS_UDP -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -A OUTPUT -p 47 -j ACCEPT

# FORWARD
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -p tcp -m multiport --dports $PORTAS_REDE_INTERNA -j ACCEPT
iptables -A FORWARD -p tcp -m multiport --dports $PORTAS_TCP -j ACCEPT
iptables -A FORWARD -p udp -m multiport --dports $PORTAS_UDP -j ACCEPT

# INPUT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 3128 -j ACCEPT
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A INPUT -p 47 -j ACCEPT
iptables -A INPUT -s $REDE_INTERNA -p icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Compartilhamento
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

0 0

Quote